CVE-2026-104905
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. Attackers can submit a serialized XLSXWriter object as the field value to invoke its __destruct() method, deleting arbitrary attacker-specified files such as config.php or backup data, resulting in denial of service and potential application reinstall hijack.
Risk Assessment
The risk includes the possibility of deleting critical configuration files and data, which can cause system unavailability and potentially allow an attacker to take over the application reinstallation process.
Recommendation
It is recommended to immediately upgrade FacturaScripts to version 2026.7 or later and restrict access to POST data processing functions for authenticated users.
Other vulnerabilities in FacturaScripts
See all- CVE-2026-27964Low
FacturaScripts up to version 2025.7 has a Reflected XSS vulnerability via the fsNick cookie parameter. The cookie value is reflected in HTML without sanitization, allowing script execution before redirect. Fixed in version 2025.8.
- CVE-2026-27892Medium
FacturaScripts before version 2026 stores and serves uploaded images without stripping EXIF/XMP/IPTC metadata. Authenticated users can download an image and extract the uploader's personal data such as GPS coordinates, device information, and timestamps.
- CVE-2026-27891High
FacturaScripts versions 2026 and below contain a critical vulnerability in the Plugins::add() function that fails to properly validate file paths within uploaded ZIP archives. This allows a Zip Slip attack, leading to arbitrary file write and remote code execution (RCE) by overwriting sensitive .php files outside the plugins directory.
- CVE-2026-32699Medium
FacturaScripts up to version 2025.92 fails to validate the 'nick' parameter during a POST request to the EditUser controller. Although the UI prevents editing this field, an attacker can intercept the request and modify the parameter to rename any account, including the administrator.
Original NVD description (English source)
FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. Attackers can submit a serialized XLSXWriter object as the field value to invoke its __destruct() method, deleting arbitrary attacker-specified files such as config.php or backup data, resulting in denial of service and potential application reinstall hijack.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS